CVE ID :CVE-2026-126541
Published : Nov. 11, 2026, 12:58 a.m. | 16 minutes ago
Description :WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users’ stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims’ HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
Published : Nov. 11, 2026, 12:58 a.m. | 16 minutes ago
Description :WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users’ stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims’ HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…